first commit
This commit is contained in:
22
apps/traefik-ui/datas.tf
Normal file
22
apps/traefik-ui/datas.tf
Normal file
@@ -0,0 +1,22 @@
|
||||
locals {
|
||||
common-labels = {
|
||||
"vynil.solidite.fr/owner-name" = var.instance
|
||||
"vynil.solidite.fr/owner-namespace" = var.namespace
|
||||
"vynil.solidite.fr/owner-category" = var.category
|
||||
"vynil.solidite.fr/owner-component" = var.component
|
||||
"app.kubernetes.io/managed-by" = "vynil"
|
||||
"app.kubernetes.io/name" = var.component
|
||||
"app.kubernetes.io/instance" = var.instance
|
||||
}
|
||||
}
|
||||
|
||||
data "kubernetes_secret_v1" "authentik" {
|
||||
metadata {
|
||||
name = "authentik"
|
||||
namespace = "${var.domain}-auth"
|
||||
}
|
||||
}
|
||||
|
||||
data "kustomization_overlay" "data" {
|
||||
resources = []
|
||||
}
|
||||
121
apps/traefik-ui/forward.tf
Normal file
121
apps/traefik-ui/forward.tf
Normal file
@@ -0,0 +1,121 @@
|
||||
locals {
|
||||
authentik-token = data.kubernetes_secret_v1.authentik.data["AUTHENTIK_BOOTSTRAP_TOKEN"]
|
||||
request_headers = {
|
||||
"Content-Type" = "application/json"
|
||||
Authorization = "Bearer ${local.authentik-token}"
|
||||
}
|
||||
forward-outpost-providers = jsondecode(data.http.get_forward_outpost.response_body).results[0].providers
|
||||
forward-outpost-pk = jsondecode(data.http.get_forward_outpost.response_body).results[0].pk
|
||||
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
|
||||
app-icon = "dashboard/statics/icons/favicon-96x96.png"
|
||||
main-group = format("%s-users", local.app-name)
|
||||
sub-groups = []
|
||||
access-token-validity = "minutes=10"
|
||||
}
|
||||
|
||||
|
||||
data "authentik_flow" "default-authorization-flow" {
|
||||
depends_on = [authentik_group.prj_users]
|
||||
slug = "default-provider-authorization-implicit-consent"
|
||||
}
|
||||
|
||||
resource "authentik_provider_proxy" "prj_forward" {
|
||||
name = local.app-name
|
||||
external_host = format("https://%s.%s", var.sub-domain, var.domain-name)
|
||||
authorization_flow = data.authentik_flow.default-authorization-flow.id
|
||||
mode = "forward_single"
|
||||
access_token_validity = local.access-token-validity
|
||||
}
|
||||
|
||||
|
||||
resource "authentik_application" "prj_application" {
|
||||
name = local.app-name
|
||||
slug = local.app-name
|
||||
protocol_provider = authentik_provider_proxy.prj_forward.id
|
||||
meta_launch_url = format("https://%s.%s", var.sub-domain, var.domain-name)
|
||||
meta_icon = format("https://%s.%s/%s", var.sub-domain, var.domain-name, local.app-icon)
|
||||
}
|
||||
|
||||
resource "authentik_group" "prj_users" {
|
||||
name = local.main-group
|
||||
}
|
||||
|
||||
resource "authentik_group" "subgroup" {
|
||||
count = length(local.sub-groups)
|
||||
name = format("%s-%s", local.app-name, local.sub-groups[count.index])
|
||||
parent = authentik_group.prj_users.id
|
||||
}
|
||||
|
||||
data "authentik_group" "vynil-admin" {
|
||||
depends_on = [authentik_group.prj_users] # fake dependency so it is not evaluated at plan stage
|
||||
name = "vynil-forward-admins"
|
||||
}
|
||||
|
||||
resource "authentik_policy_binding" "prj_access_users" {
|
||||
target = authentik_application.prj_application.uuid
|
||||
group = authentik_group.prj_users.id
|
||||
order = 0
|
||||
}
|
||||
resource "authentik_policy_binding" "prj_access_vynil" {
|
||||
target = authentik_application.prj_application.uuid
|
||||
group = data.authentik_group.vynil-admin.id
|
||||
order = 1
|
||||
}
|
||||
|
||||
data "http" "get_forward_outpost" {
|
||||
depends_on = [authentik_provider_proxy.prj_forward]
|
||||
url = "http://authentik.${var.domain}-auth.svc/api/v3/outposts/instances/?name__iexact=forward"
|
||||
method = "GET"
|
||||
request_headers = local.request_headers
|
||||
lifecycle {
|
||||
postcondition {
|
||||
condition = contains([200], self.status_code)
|
||||
error_message = "Status code invalid"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "restapi" {
|
||||
uri = "http://authentik.${var.domain}-auth.svc/api/v3/"
|
||||
headers = local.request_headers
|
||||
create_method = "PATCH"
|
||||
update_method = "PATCH"
|
||||
destroy_method = "PATCH"
|
||||
write_returns_object = true
|
||||
id_attribute = "name"
|
||||
}
|
||||
|
||||
resource "restapi_object" "forward_outpost_binding" {
|
||||
path = "/outposts/instances/${local.forward-outpost-pk}/"
|
||||
data = jsonencode({
|
||||
name = "forward"
|
||||
providers = contains(local.forward-outpost-providers, authentik_provider_proxy.prj_forward.id) ? local.forward-outpost-providers : concat(local.forward-outpost-providers, [authentik_provider_proxy.prj_forward.id])
|
||||
})
|
||||
}
|
||||
|
||||
resource "kubectl_manifest" "prj_middleware" {
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: "forward-${local.app-name}"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: http://ak-outpost-forward.${var.domain}-auth.svc:9000/outpost.goauthentik.io/auth/traefik
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-authentik-username
|
||||
# - X-authentik-groups
|
||||
# - X-authentik-email
|
||||
# - X-authentik-name
|
||||
# - X-authentik-uid
|
||||
# - X-authentik-jwt
|
||||
# - X-authentik-meta-jwks
|
||||
# - X-authentik-meta-outpost
|
||||
# - X-authentik-meta-provider
|
||||
# - X-authentik-meta-app
|
||||
# - X-authentik-meta-version
|
||||
EOF
|
||||
}
|
||||
44
apps/traefik-ui/index.yaml
Normal file
44
apps/traefik-ui/index.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
---
|
||||
apiVersion: vinyl.solidite.fr/v1beta1
|
||||
kind: Component
|
||||
category: apps
|
||||
metadata:
|
||||
name: traefik-ui
|
||||
description: Access to the Traefik UI
|
||||
options:
|
||||
sub-domain:
|
||||
default: traefik
|
||||
examples:
|
||||
- traefik
|
||||
type: string
|
||||
ingress-class:
|
||||
default: traefik
|
||||
examples:
|
||||
- traefik
|
||||
type: string
|
||||
domain-name:
|
||||
default: your_company.com
|
||||
examples:
|
||||
- your_company.com
|
||||
type: string
|
||||
domain:
|
||||
default: your-company
|
||||
examples:
|
||||
- your-company
|
||||
type: string
|
||||
issuer:
|
||||
default: letsencrypt-prod
|
||||
examples:
|
||||
- letsencrypt-prod
|
||||
type: string
|
||||
dependencies:
|
||||
- dist: null
|
||||
category: share
|
||||
component: authentik-forward
|
||||
providers:
|
||||
kubernetes: true
|
||||
authentik: true
|
||||
kubectl: true
|
||||
postgresql: null
|
||||
restapi: true
|
||||
http: true
|
||||
75
apps/traefik-ui/ingress.tf
Normal file
75
apps/traefik-ui/ingress.tf
Normal file
@@ -0,0 +1,75 @@
|
||||
locals {
|
||||
dns-names = ["${var.sub-domain}.${var.domain-name}"]
|
||||
middlewares = ["${var.instance}-https", "forward-${local.app-name}"]
|
||||
service = {
|
||||
"name" = "${var.component}-${var.instance}"
|
||||
"port" = {
|
||||
"number" = 80
|
||||
}
|
||||
}
|
||||
rules = [ for v in local.dns-names : {
|
||||
"host" = "${v}"
|
||||
"http" = {
|
||||
"paths" = [{
|
||||
"backend" = {
|
||||
"service" = local.service
|
||||
}
|
||||
"path" = "/"
|
||||
"pathType" = "Prefix"
|
||||
}]
|
||||
}
|
||||
}]
|
||||
}
|
||||
|
||||
resource "kubectl_manifest" "prj_certificate" {
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: "cert-manager.io/v1"
|
||||
kind: "Certificate"
|
||||
metadata:
|
||||
name: "${var.instance}"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
spec:
|
||||
secretName: "${var.instance}-cert"
|
||||
dnsNames: ${jsonencode(local.dns-names)}
|
||||
issuerRef:
|
||||
name: "${var.issuer}"
|
||||
kind: "ClusterIssuer"
|
||||
group: "cert-manager.io"
|
||||
EOF
|
||||
}
|
||||
|
||||
resource "kubectl_manifest" "prj_https_redirect" {
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: "traefik.containo.us/v1alpha1"
|
||||
kind: "Middleware"
|
||||
metadata:
|
||||
name: "${var.instance}-https"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
spec:
|
||||
redirectScheme:
|
||||
scheme: "https"
|
||||
permanent: true
|
||||
EOF
|
||||
}
|
||||
|
||||
resource "kubectl_manifest" "prj_ingress" {
|
||||
force_conflicts = true
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: "networking.k8s.io/v1"
|
||||
kind: "Ingress"
|
||||
metadata:
|
||||
name: "${var.instance}"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
annotations:
|
||||
"traefik.ingress.kubernetes.io/router.middlewares": "${join(",", [for m in local.middlewares : format("%s-%s@kubernetescrd", var.namespace, m)])}"
|
||||
spec:
|
||||
ingressClassName: "${var.ingress-class}"
|
||||
rules: ${jsonencode(local.rules)}
|
||||
tls:
|
||||
- hosts: ${jsonencode(local.dns-names)}
|
||||
secretName: "${var.instance}-cert"
|
||||
EOF
|
||||
}
|
||||
21
apps/traefik-ui/svc.tf
Normal file
21
apps/traefik-ui/svc.tf
Normal file
@@ -0,0 +1,21 @@
|
||||
resource "kubectl_manifest" "service" {
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: "${var.component}-${var.instance}"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: 9000
|
||||
selector:
|
||||
vynil.solidite.fr/owner-namespace: ${var.namespace}
|
||||
vynil.solidite.fr/owner-component: traefik
|
||||
vynil.solidite.fr/owner-category: share
|
||||
EOF
|
||||
}
|
||||
Reference in New Issue
Block a user